Knowledge Card Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:01 AM UTC
• Version: 1.2.2

Overview

This knowledge-card skill has a coherent purpose, but it needs Review because it renders untrusted content in a JavaScript-capable browser and includes credential-backed Feishu sending without clear scoping or consent.

Review before installing. Use only with trusted or sanitized input, restrict Chromium network access, validate output paths, and avoid the Feishu credential/API flow unless the user explicitly approves the destination and identity. Remove or override the default brand if it is not intended.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:54

Finding

Forced Promotional Branding in User-Requested Output

Content

View full analysis

加粗强调关键词" }, ... ]' \ --quote "底部金句（可选）" \ --quote-author "—— 作者" \ --brand "心光年觉醒读书会" \ --vol "Vol.01 · 系列名" \ --output /tmp/output.png ``` The default is reinforced at `SKILL.md`, lines 171-174: ```markdown ## Notes - Default brand: "心光年觉醒读书会" (can be overridden with `--brand`) - Output is always 800px × auto height, 3x DPI (2400px actual width) ``` ### Technical Analysis The Skill instructions direct the agent to include an organization-specific brand in generated images by default. Branding is not necessary to perform the declared function of converting user-provided material into a knowledge card. Because the behavior is specified in the Skill workflow, an agent following the instructions will modify user-visible output even when the user did not request branding. This constitutes instruction-level output hijacking: unrelated promotional content is introduced as part of the expected execution path. The branding does not grant operating-system privileges or execute code. Its security relevance is limited to manipulation of the agent's output and misuse of the user's requested content as a promotional channel. ### Attack Path 1. A user asks the agent to generate a knowledge card. 2. The agent loads and follows `SKILL.md`. 3. The documented command supplies the predefined `--brand` value. 4. The renderer embeds that brand into the image footer. 5. The agent sends the branded image as the requested result without obtaining ex ...[truncated 412 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.js:55

Finding

Unescaped User Input Enables HTML and Script Injection in Chromium

Content

View full analysis

`

${String(i + 1).padStart(2, '0')}

${String(i + 1).padStart(2, '0')}

${item.title} ${item.tag ? `${item.tag}` : ''}

${item.quote ? `

"${item.quote}"

` : ''}

${item.desc || ''}

`).join(''); ``` Additional fields are also interpolated without escaping: ```javascript

📖 ${badge}

${title}${subtitle ? `
${subtitle}

Remediation

View remediation

`, `"`, and `'`. - Do not permit arbitrary HTML in descriptions. Represent emphasis as structured data, Markdown parsed with a strict allowlist, or sanitized HTML allowing only noninteractive formatting tags such as `` and ``. - Validate `color` and `bg` against a strict CSS color format, such as: ```javascript /^#[0-9A-Fa-f]{6}$/ ``` - Validate the complete concepts object against a schema, including types, lengths, maximum concept count, and allowed properties. - Add a restrictive Content Security Policy that disables scripts, frames, plugins, navigation, and unauthorized connections. - Disable browser network access during rendering using Playwright request routing. Bundle fonts locally instead of loading Google Fonts. - Consider generating the document through DOM APIs using `textContent` rather than assembling raw HTML strings. - Run Chromium under a dedicated, low-privilege account with sandboxing enabled. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.js:51

Finding

Unrestricted Output Path Allows Overwriting Arbitrary Writable Files

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

node scripts/generate.js \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

node scripts/generate.js \

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

# Step 4a: 获取 token
APP_ID="your_feishu_app_id"        # 替换成你的飞书 App ID
APP_SECRET="your_feishu_app_secret"  # 替换成你的飞书 App Secret
TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

| python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")

# Step 4b: 上传图片，获取 image_key
IMAGE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/images" \
  -H "Authorization: Bearer $TOKEN" \
  -F "image_type=message" \
  -F "image=@/path/to/output.png" \

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger conditions are broad enough to activate on ordinary requests to summarize or visualize content, which increases the chance the skill will run in contexts the user did not clearly intend. In this skill, over-broad activation is more dangerous because execution may lead to file reads, script execution, and external transmission steps later in the workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s core purpose is to generate a knowledge card image, but it additionally instructs the agent to obtain Feishu access tokens using app credentials and directly upload/send content through external APIs. This expands the trust boundary unnecessarily, creates a path for credential handling inside skill instructions, and can exfiltrate generated content and metadata to third-party services without strong justification or safety controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs uploading generated images to Feishu APIs without clearly warning the user that their content will be transmitted off-platform. If the source material includes private notes, book annotations, meeting content, or sensitive summaries, this can cause unconsented disclosure to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This instruction sends data to an external Feishu authentication endpoint and handles app credentials within the skill flow. Even though the endpoint is legitimate, embedding external transmission and credential use in skill instructions increases the risk of secret exposure, unauthorized API use, and expansion of data flows beyond the user’s expectations.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

# Step 4a: 获取 token
APP_ID="your_feishu_app_id"        # 替换成你的飞书 App ID
APP_SECRET="your_feishu_app_secret"  # 替换成你的飞书 App Secret
TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

This step sends a message via Feishu’s external API, transmitting identifiers and uploaded content outside the local chat/tool boundary. In the context of a content-visualization skill, this is sensitive because user-provided material may contain confidential information and there is no built-in consent or minimization described.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

# Step 4c: 发送图片消息
# receive_id 是目标用户的 open_id 或群的 chat_id
# receive_id_type: open_id（私聊）或 chat_id（群聊）
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"receive_id\":\"$RECEIVE_ID\",\"msg_type\":\"image\",\"content\":\"{\\\"image_key\\\":\\\"$IMAGE_KEY\\\"}\"}"

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

#### QQ 渠道（channel=qqbot）
使用 `qqbot-media` skill 的 `<qqmedia>` 标签发送图片：
先读取 `~/.openclaw/workspace/skills/qqbot-media/SKILL.md` 获取详细用法。

#### 其他渠道（Discord、Telegram、WeChat 等）
使用 `message` 工具：

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The output path is taken directly from a user-controlled CLI argument and then used as the screenshot destination without validation. In an agent or automation context, this can overwrite arbitrary files writable by the process, including sensitive application data or files outside the intended workspace.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The generated HTML imports Google Fonts via an external URL, so rendering a local file causes Playwright/Chromium to make outbound network requests. This leaks execution metadata such as IP/addressing and timing to a third party, creates non-deterministic behavior in offline or restricted environments, and expands the attack surface beyond purely local rendering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The undisclosed Google Fonts fetch is a real security/privacy concern because local rendering silently triggers third-party network access. Even if the same behavior is already captured by the SDI-2 finding, the absence of disclosure increases risk in privacy-sensitive or sandboxed agent environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file first claims the PNG card is generated at 2400px width and 3x DPI, then later states the output is always 800px × auto height with 2400px actual width. These statements conflict and can mislead operators about what the script actually produces.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The HTML sets lang="zh-CN", and the script defaults and labels are written in Chinese, indicating a fixed locale assumption. There is no natural-language indication that users may select another language or locale, which can violate language-choice policy when not explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code writes a temporary HTML file, saves a PNG to the requested output path, and then deletes the temporary file. While these file operations are central to the script's purpose, there is no runtime notice, confirmation, or explanatory comment near the operations themselves beyond the high-level usage header, so users are not explicitly warned that filesystem changes will occur.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.